certificate presented during ssl session establishment.
*/
-
+/* <DESC>
+ * demonstrates use of SSL context callback, requires OpenSSL
+ * </DESC>
+ */
/*
* Copyright (c) 2003 The OpenEvidence Project. All rights reserved.
* "This product includes software developed by the Openevidence Project
* for use in the OpenEvidence Toolkit. (http://www.openevidence.org/)"
* This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ * for use in the OpenSSL Toolkit (https://www.openssl.org/)"
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com)."
* "This product includes software developed by the OpenEvidence Project
* for use in the OpenEvidence Toolkit (http://www.openevidence.org/)
* This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ * for use in the OpenSSL Toolkit (https://www.openssl.org/)"
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com)."
* ====================================================================
*
* This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.openssl.org/)
+ * for use in the OpenSSL Toolkit (https://www.openssl.org/)
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
static const char *curlx_usage[]={
"usage: curlx args\n",
" -p12 arg - tia file ",
- " -envpass arg - environement variable which content the tia private key password",
+ " -envpass arg - environement variable which content the tia private"
+ " key password",
" -out arg - output file (response)- default stdout",
" -in arg - input file (request)- default stdin",
- " -connect arg - URL of the server for the connection ex: www.openevidence.org",
- " -mimetype arg - MIME type for data in ex : application/timestamp-query or application/dvcs -default application/timestamp-query",
- " -acceptmime arg - MIME type acceptable for the response ex : application/timestamp-response or application/dvcs -default none",
- " -accesstype arg - an Object identifier in an AIA/SIA method, e.g. AD_DVCS or ad_timestamping",
+ " -connect arg - URL of the server for the connection ex:"
+ " www.openevidence.org",
+ " -mimetype arg - MIME type for data in ex : application/timestamp-query"
+ " or application/dvcs -default application/timestamp-query",
+ " -acceptmime arg - MIME type acceptable for the response ex : "
+ "application/timestamp-response or application/dvcs -default none",
+ " -accesstype arg - an Object identifier in an AIA/SIA method, e.g."
+ " AD_DVCS or ad_timestamping",
NULL
};
/* This is a context that we pass to all callbacks */
typedef struct sslctxparm_st {
- unsigned char * p12file ;
- const char * pst ;
- PKCS12 * p12 ;
- EVP_PKEY * pkey ;
- X509 * usercert ;
- STACK_OF(X509) * ca ;
+ unsigned char * p12file;
+ const char * pst;
+ PKCS12 * p12;
+ EVP_PKEY * pkey;
+ X509 * usercert;
+ STACK_OF(X509) * ca;
CURL * curl;
BIO * errorbio;
- int accesstype ;
+ int accesstype;
int verbose;
} sslctxparm;
/* some helper function. */
-static char *i2s_ASN1_IA5STRING( ASN1_IA5STRING *ia5)
+static char *ia5string(ASN1_IA5STRING *ia5)
{
char *tmp;
if(!ia5 || !ia5->length)
}
/* A conveniance routine to get an access URI. */
-
-static unsigned char *my_get_ext(X509 * cert, const int type, int extensiontype) {
-
+static unsigned char *my_get_ext(X509 *cert, const int type,
+ int extensiontype)
+{
int i;
- STACK_OF(ACCESS_DESCRIPTION) * accessinfo ;
- accessinfo = X509_get_ext_d2i(cert, extensiontype, NULL, NULL) ;
+ STACK_OF(ACCESS_DESCRIPTION) * accessinfo;
+ accessinfo = X509_get_ext_d2i(cert, extensiontype, NULL, NULL);
- if (!sk_ACCESS_DESCRIPTION_num(accessinfo))
+ if(!sk_ACCESS_DESCRIPTION_num(accessinfo))
return NULL;
- for (i = 0; i < sk_ACCESS_DESCRIPTION_num(accessinfo); i++) {
+ for(i = 0; i < sk_ACCESS_DESCRIPTION_num(accessinfo); i++) {
ACCESS_DESCRIPTION * ad = sk_ACCESS_DESCRIPTION_value(accessinfo, i);
- if (OBJ_obj2nid(ad->method) == type) {
- if (ad->location->type == GEN_URI) {
- return i2s_ASN1_IA5STRING(ad->location->d.ia5);
+ if(OBJ_obj2nid(ad->method) == type) {
+ if(ad->location->type == GEN_URI) {
+ return ia5string(ad->location->d.ia5);
}
return NULL;
}
sslctxparm * p = (sslctxparm *) arg;
int ok;
- if (p->verbose > 2)
- BIO_printf(p->errorbio,"entering ssl_app_verify_callback\n");
+ if(p->verbose > 2)
+ BIO_printf(p->errorbio, "entering ssl_app_verify_callback\n");
- if ((ok= X509_verify_cert(ctx)) && ctx->cert) {
- unsigned char * accessinfo ;
- if (p->verbose > 1)
- X509_print_ex(p->errorbio,ctx->cert,0,0);
+ if((ok= X509_verify_cert(ctx)) && ctx->cert) {
+ unsigned char * accessinfo;
+ if(p->verbose > 1)
+ X509_print_ex(p->errorbio, ctx->cert, 0, 0);
- if (accessinfo = my_get_ext(ctx->cert,p->accesstype ,NID_sinfo_access)) {
- if (p->verbose)
- BIO_printf(p->errorbio,"Setting URL from SIA to: %s\n", accessinfo);
+ if(accessinfo = my_get_ext(ctx->cert, p->accesstype, NID_sinfo_access)) {
+ if(p->verbose)
+ BIO_printf(p->errorbio, "Setting URL from SIA to: %s\n", accessinfo);
- curl_easy_setopt(p->curl, CURLOPT_URL,accessinfo);
+ curl_easy_setopt(p->curl, CURLOPT_URL, accessinfo);
}
- else if (accessinfo = my_get_ext(ctx->cert,p->accesstype,
- NID_info_access)) {
- if (p->verbose)
- BIO_printf(p->errorbio,"Setting URL from AIA to: %s\n", accessinfo);
+ else if(accessinfo = my_get_ext(ctx->cert, p->accesstype,
+ NID_info_access)) {
+ if(p->verbose)
+ BIO_printf(p->errorbio, "Setting URL from AIA to: %s\n", accessinfo);
- curl_easy_setopt(p->curl, CURLOPT_URL,accessinfo);
+ curl_easy_setopt(p->curl, CURLOPT_URL, accessinfo);
}
}
- if (p->verbose > 2)
- BIO_printf(p->errorbio,"leaving ssl_app_verify_callback with %d\n", ok);
- return(ok);
+ if(p->verbose > 2)
+ BIO_printf(p->errorbio, "leaving ssl_app_verify_callback with %d\n", ok);
+
+ return ok;
}
-/* This is an example of an curl SSL initialisation call back. The callback sets:
+/* The SSL initialisation callback. The callback sets:
- a private key and certificate
- a trusted ca certificate
- a preferred cipherlist
- an application verification callback (the function above)
*/
-static CURLcode sslctxfun(CURL * curl, void * sslctx, void * parm) {
-
+static CURLcode sslctxfun(CURL * curl, void * sslctx, void * parm)
+{
sslctxparm * p = (sslctxparm *) parm;
- SSL_CTX * ctx = (SSL_CTX *) sslctx ;
+ SSL_CTX * ctx = (SSL_CTX *) sslctx;
- if (!SSL_CTX_use_certificate(ctx,p->usercert)) {
- BIO_printf(p->errorbio, "SSL_CTX_use_certificate problem\n"); goto err;
+ if(!SSL_CTX_use_certificate(ctx, p->usercert)) {
+ BIO_printf(p->errorbio, "SSL_CTX_use_certificate problem\n");
+ goto err;
}
- if (!SSL_CTX_use_PrivateKey(ctx,p->pkey)) {
- BIO_printf(p->errorbio, "SSL_CTX_use_PrivateKey\n"); goto err;
+ if(!SSL_CTX_use_PrivateKey(ctx, p->pkey)) {
+ BIO_printf(p->errorbio, "SSL_CTX_use_PrivateKey\n");
+ goto err;
}
- if (!SSL_CTX_check_private_key(ctx)) {
- BIO_printf(p->errorbio, "SSL_CTX_check_private_key\n"); goto err;
+ if(!SSL_CTX_check_private_key(ctx)) {
+ BIO_printf(p->errorbio, "SSL_CTX_check_private_key\n");
+ goto err;
}
- SSL_CTX_set_quiet_shutdown(ctx,1);
- SSL_CTX_set_cipher_list(ctx,"RC4-MD5");
+ SSL_CTX_set_quiet_shutdown(ctx, 1);
+ SSL_CTX_set_cipher_list(ctx, "RC4-MD5");
SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
- X509_STORE_add_cert(SSL_CTX_get_cert_store(ctx), sk_X509_value(p->ca, sk_X509_num(p->ca)-1));
-
- SSL_CTX_set_verify_depth(ctx,2);
-
- SSL_CTX_set_verify(ctx,SSL_VERIFY_PEER,ZERO_NULL);
+ X509_STORE_add_cert(SSL_CTX_get_cert_store(ctx),
+ sk_X509_value(p->ca, sk_X509_num(p->ca)-1));
+ SSL_CTX_set_verify_depth(ctx, 2);
+ SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, ZERO_NULL);
SSL_CTX_set_cert_verify_callback(ctx, ssl_app_verify_callback, parm);
-
- return CURLE_OK ;
+ return CURLE_OK;
err:
ERR_print_errors(p->errorbio);
return CURLE_SSL_CERTPROBLEM;
}
-int main(int argc, char **argv) {
-
+int main(int argc, char **argv)
+{
BIO* in=NULL;
BIO* out=NULL;
char * outfile = NULL;
- char * infile = NULL ;
+ char * infile = NULL;
int tabLength=100;
char *binaryptr;
char* contenttype;
const char** pp;
unsigned char* hostporturl = NULL;
- BIO * p12bio ;
+ BIO * p12bio;
char **args = argv + 1;
unsigned char * serverurl;
sslctxparm p;
OpenSSL_add_all_digests();
ERR_load_crypto_strings();
-
-
- while (*args && *args[0] == '-') {
- if (!strcmp (*args, "-in")) {
- if (args[1]) {
+ while(*args && *args[0] == '-') {
+ if(!strcmp (*args, "-in")) {
+ if(args[1]) {
infile=*(++args);
- } else badarg=1;
- } else if (!strcmp (*args, "-out")) {
- if (args[1]) {
+ }
+ else
+ badarg=1;
+ }
+ else if(!strcmp (*args, "-out")) {
+ if(args[1]) {
outfile=*(++args);
- } else badarg=1;
- } else if (!strcmp (*args, "-p12")) {
- if (args[1]) {
+ }
+ else
+ badarg=1;
+ }
+ else if(!strcmp (*args, "-p12")) {
+ if(args[1]) {
p.p12file = *(++args);
- } else badarg=1;
- } else if (strcmp(*args,"-envpass") == 0) {
- if (args[1]) {
+ }
+ else
+ badarg=1;
+ }
+ else if(strcmp(*args, "-envpass") == 0) {
+ if(args[1]) {
p.pst = getenv(*(++args));
- } else badarg=1;
- } else if (strcmp(*args,"-connect") == 0) {
- if (args[1]) {
+ }
+ else
+ badarg=1;
+ }
+ else if(strcmp(*args, "-connect") == 0) {
+ if(args[1]) {
hostporturl = *(++args);
- } else badarg=1;
- } else if (strcmp(*args,"-mimetype") == 0) {
- if (args[1]) {
+ }
+ else
+ badarg=1;
+ }
+ else if(strcmp(*args, "-mimetype") == 0) {
+ if(args[1]) {
mimetype = *(++args);
- } else badarg=1;
- } else if (strcmp(*args,"-acceptmime") == 0) {
- if (args[1]) {
+ }
+ else
+ badarg=1;
+ }
+ else if(strcmp(*args, "-acceptmime") == 0) {
+ if(args[1]) {
mimetypeaccept = *(++args);
- } else badarg=1;
- } else if (strcmp(*args,"-accesstype") == 0) {
- if (args[1]) {
- if ((p.accesstype = OBJ_obj2nid(OBJ_txt2obj(*++args,0))) == 0) badarg=1;
- } else badarg=1;
- } else if (strcmp(*args,"-verbose") == 0) {
+ }
+ else
+ badarg=1;
+ }
+ else if(strcmp(*args, "-accesstype") == 0) {
+ if(args[1]) {
+ if((p.accesstype = OBJ_obj2nid(OBJ_txt2obj(*++args, 0))) == 0)
+ badarg=1;
+ }
+ else
+ badarg=1;
+ }
+ else if(strcmp(*args, "-verbose") == 0) {
p.verbose++;
- } else badarg=1;
+ }
+ else
+ badarg=1;
args++;
}
- if (mimetype==NULL || mimetypeaccept == NULL) badarg = 1;
+ if(mimetype==NULL || mimetypeaccept == NULL)
+ badarg = 1;
- if (badarg) {
- for (pp=curlx_usage; (*pp != NULL); pp++)
- BIO_printf(p.errorbio,"%s\n",*pp);
- BIO_printf(p.errorbio,"\n");
+ if(badarg) {
+ for(pp=curlx_usage; (*pp != NULL); pp++)
+ BIO_printf(p.errorbio, "%s\n", *pp);
+ BIO_printf(p.errorbio, "\n");
goto err;
}
-
-
/* set input */
- if ((in=BIO_new(BIO_s_file())) == NULL) {
+ if((in=BIO_new(BIO_s_file())) == NULL) {
BIO_printf(p.errorbio, "Error setting input bio\n");
goto err;
- } else if (infile == NULL)
- BIO_set_fp(in,stdin,BIO_NOCLOSE|BIO_FP_TEXT);
- else if (BIO_read_filename(in,infile) <= 0) {
+ }
+ else if(infile == NULL)
+ BIO_set_fp(in, stdin, BIO_NOCLOSE|BIO_FP_TEXT);
+ else if(BIO_read_filename(in, infile) <= 0) {
BIO_printf(p.errorbio, "Error opening input file %s\n", infile);
BIO_free(in);
goto err;
/* set output */
- if ((out=BIO_new(BIO_s_file())) == NULL) {
+ if((out=BIO_new(BIO_s_file())) == NULL) {
BIO_printf(p.errorbio, "Error setting output bio.\n");
goto err;
- } else if (outfile == NULL)
- BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
- else if (BIO_write_filename(out,outfile) <= 0) {
+ }
+ else if(outfile == NULL)
+ BIO_set_fp(out, stdout, BIO_NOCLOSE|BIO_FP_TEXT);
+ else if(BIO_write_filename(out, outfile) <= 0) {
BIO_printf(p.errorbio, "Error opening output file %s\n", outfile);
BIO_free(out);
goto err;
p.errorbio = BIO_new_fp (stderr, BIO_NOCLOSE);
- if (!(p.curl = curl_easy_init())) {
+ if(!(p.curl = curl_easy_init())) {
BIO_printf(p.errorbio, "Cannot init curl lib\n");
goto err;
}
-
-
- if (!(p12bio = BIO_new_file(p.p12file , "rb"))) {
- BIO_printf(p.errorbio, "Error opening P12 file %s\n", p.p12file); goto err;
+ if(!(p12bio = BIO_new_file(p.p12file , "rb"))) {
+ BIO_printf(p.errorbio, "Error opening P12 file %s\n", p.p12file);
+ goto err;
}
- if (!(p.p12 = d2i_PKCS12_bio (p12bio, NULL))) {
- BIO_printf(p.errorbio, "Cannot decode P12 structure %s\n", p.p12file); goto err;
+ if(!(p.p12 = d2i_PKCS12_bio (p12bio, NULL))) {
+ BIO_printf(p.errorbio, "Cannot decode P12 structure %s\n", p.p12file);
+ goto err;
}
p.ca= NULL;
- if (!(PKCS12_parse (p.p12, p.pst, &(p.pkey), &(p.usercert), &(p.ca) ) )) {
- BIO_printf(p.errorbio,"Invalid P12 structure in %s\n", p.p12file); goto err;
+ if(!(PKCS12_parse (p.p12, p.pst, &(p.pkey), &(p.usercert), &(p.ca) ) )) {
+ BIO_printf(p.errorbio, "Invalid P12 structure in %s\n", p.p12file);
+ goto err;
}
- if (sk_X509_num(p.ca) <= 0) {
- BIO_printf(p.errorbio,"No trustworthy CA given.%s\n", p.p12file); goto err;
+ if(sk_X509_num(p.ca) <= 0) {
+ BIO_printf(p.errorbio, "No trustworthy CA given.%s\n", p.p12file);
+ goto err;
}
- if (p.verbose > 1)
- X509_print_ex(p.errorbio,p.usercert,0,0);
+ if(p.verbose > 1)
+ X509_print_ex(p.errorbio, p.usercert, 0, 0);
/* determine URL to go */
- if (hostporturl) {
- serverurl = malloc(9+strlen(hostporturl));
- sprintf(serverurl,"https://%s",hostporturl);
+ if(hostporturl) {
+ size_t len = strlen(hostporturl) + 9;
+ serverurl = malloc(len);
+ snprintf(serverurl, len, "https://%s", hostporturl);
}
- else if (p.accesstype != 0) { /* see whether we can find an AIA or SIA for a given access type */
- if (!(serverurl = my_get_ext(p.usercert,p.accesstype,NID_info_access))) {
+ else if(p.accesstype != 0) { /* see whether we can find an AIA or SIA for a
+ given access type */
+ if(!(serverurl = my_get_ext(p.usercert, p.accesstype, NID_info_access))) {
int j=0;
- BIO_printf(p.errorbio,"no service URL in user cert "
+ BIO_printf(p.errorbio, "no service URL in user cert "
"cherching in others certificats\n");
- for (j=0;j<sk_X509_num(p.ca);j++) {
- if ((serverurl = my_get_ext(sk_X509_value(p.ca,j),p.accesstype,
+ for(j=0; j<sk_X509_num(p.ca); j++) {
+ if((serverurl = my_get_ext(sk_X509_value(p.ca, j), p.accesstype,
NID_info_access)))
break;
- if ((serverurl = my_get_ext(sk_X509_value(p.ca,j),p.accesstype,
+ if((serverurl = my_get_ext(sk_X509_value(p.ca, j), p.accesstype,
NID_sinfo_access)))
break;
}
}
}
- if (!serverurl) {
+ if(!serverurl) {
BIO_printf(p.errorbio, "no service URL in certificats,"
" check '-accesstype (AD_DVCS | ad_timestamping)'"
" or use '-connect'\n");
goto err;
}
- if (p.verbose)
+ if(p.verbose)
BIO_printf(p.errorbio, "Service URL: <%s>\n", serverurl);
curl_easy_setopt(p.curl, CURLOPT_URL, serverurl);
/* Now specify the POST binary data */
curl_easy_setopt(p.curl, CURLOPT_POSTFIELDS, binaryptr);
- curl_easy_setopt(p.curl, CURLOPT_POSTFIELDSIZE,(long)tabLength);
+ curl_easy_setopt(p.curl, CURLOPT_POSTFIELDSIZE, (long)tabLength);
/* pass our list of custom made headers */
contenttype = malloc(15+strlen(mimetype));
- sprintf(contenttype,"Content-type: %s",mimetype);
- headers = curl_slist_append(headers,contenttype);
+ snprintf(contenttype, 15+strlen(mimetype), "Content-type: %s", mimetype);
+ headers = curl_slist_append(headers, contenttype);
curl_easy_setopt(p.curl, CURLOPT_HTTPHEADER, headers);
- if (p.verbose)
+ if(p.verbose)
BIO_printf(p.errorbio, "Service URL: <%s>\n", serverurl);
{
FILE *outfp;
- BIO_get_fp(out,&outfp);
+ BIO_get_fp(out, &outfp);
curl_easy_setopt(p.curl, CURLOPT_WRITEDATA, outfp);
}
- res = curl_easy_setopt(p.curl, CURLOPT_SSL_CTX_FUNCTION, sslctxfun) ;
+ res = curl_easy_setopt(p.curl, CURLOPT_SSL_CTX_FUNCTION, sslctxfun);
- if (res != CURLE_OK)
- BIO_printf(p.errorbio,"%d %s=%d %d\n", __LINE__, "CURLOPT_SSL_CTX_FUNCTION",CURLOPT_SSL_CTX_FUNCTION,res);
+ if(res != CURLE_OK)
+ BIO_printf(p.errorbio, "%d %s=%d %d\n", __LINE__,
+ "CURLOPT_SSL_CTX_FUNCTION", CURLOPT_SSL_CTX_FUNCTION, res);
curl_easy_setopt(p.curl, CURLOPT_SSL_CTX_DATA, &p);
{
int lu; int i=0;
- while ((lu = BIO_read (in,&binaryptr[i],tabLength-i)) >0 ) {
+ while((lu = BIO_read (in, &binaryptr[i], tabLength-i)) >0 ) {
i+=lu;
- if (i== tabLength) {
+ if(i== tabLength) {
tabLength+=100;
- binaryptr=realloc(binaryptr,tabLength); /* should be more careful */
+ binaryptr=realloc(binaryptr, tabLength); /* should be more careful */
}
}
tabLength = i;
/* Now specify the POST binary data */
curl_easy_setopt(p.curl, CURLOPT_POSTFIELDS, binaryptr);
- curl_easy_setopt(p.curl, CURLOPT_POSTFIELDSIZE,(long)tabLength);
+ curl_easy_setopt(p.curl, CURLOPT_POSTFIELDSIZE, (long)tabLength);
/* Perform the request, res will get the return code */
- BIO_printf(p.errorbio,"%d %s %d\n", __LINE__, "curl_easy_perform",
+ BIO_printf(p.errorbio, "%d %s %d\n", __LINE__, "curl_easy_perform",
res = curl_easy_perform(p.curl));
{
- int result =curl_easy_getinfo(p.curl,CURLINFO_CONTENT_TYPE,&response);
- if( mimetypeaccept && p.verbose)
- if(!strcmp(mimetypeaccept,response))
- BIO_printf(p.errorbio,"the response has a correct mimetype : %s\n",
+ int result =curl_easy_getinfo(p.curl, CURLINFO_CONTENT_TYPE, &response);
+ if(mimetypeaccept && p.verbose)
+ if(!strcmp(mimetypeaccept, response))
+ BIO_printf(p.errorbio, "the response has a correct mimetype : %s\n",
response);
else
- BIO_printf(p.errorbio,"the reponse doesn\'t has an acceptable "
+ BIO_printf(p.errorbio, "the response doesn\'t have an acceptable "
"mime type, it is %s instead of %s\n",
- response,mimetypeaccept);
+ response, mimetypeaccept);
}
/*** code d'erreur si accept mime ***, egalement code return HTTP != 200 ***/
BIO_free(out);
return (EXIT_SUCCESS);
- err: BIO_printf(p.errorbio,"error");
+ err: BIO_printf(p.errorbio, "error");
exit(1);
}
projects / platform / upstream / curl.git / blobdiff